ip verify unicast source reachable-via effective on border routers?

Answered Question

ip verify unicast source reachable-via uses the router's routing table to detect and prevent spoofing. On a border router with very few routes, and a static default route to the ISP's router, would verify unicast source reachable-via be effective? It seems like it would only stop a spoofed packet with the source and destination of the WAN interface, or the with an address matching the subnet between the border router and the firewall. All other packets would be allowed based on the x.x.x.x (x being the ISP's router) default route, wouldn't they?

Perhaps this questions should be in the Security/General forum? Would a moderator be able to move it there for me? I prefer not to double-post.


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)

It seems that I'm misunderstanding something about how ip verify unicast sourc reachable-via, or by its old name, ip verify unicast reverse-path works. It's designed for use on border routers, so the default route problem doesn't make sense. Does anyone know of any Cisco white papers or references on Cisco's site that explain it clearly?


This Discussion